扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 |
-----=====[ Background ]=====----- AFDKO (Adobe Font Development Kit for OpenType) is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library written in C, which provides interfaces for reading and writing Type 1, OpenType, TrueType (to some extent) and several other font formats. While the library existed as early as 2000, it was open-sourced by Adobe in 2014 on GitHub [1, 2], and is still actively developed. The font parsing code can be generally found under afdko/c/public/lib/source/*read/*.c in the project directory tree. At the time of this writing, based on the available source code, we conclude that AFDKO was originally developed to only process valid, well-formatted font files. It contains very few to no sanity checks of the input data, which makes it susceptible to memory corruption issues (e.g. buffer overflows) and other memory safety problems, if the input file doesn't conform to the format specification. We have recently discovered that starting with Windows 10 1709 (Fall Creators Update, released in October 2017), Microsoft's DirectWrite library [3] includes parts of AFDKO, and specifically the modules for reading and writing OpenType/CFF fonts (internally called cfr/cfw). The code is reachable through dwrite!AdobeCFF2Snapshot, called by methods of the FontInstancer class, called by dwrite!DWriteFontFace::CreateInstancedStream and dwrite!DWriteFactory::CreateInstancedStream. This strongly indicates that the code is used for instancing the relatively new variable fonts [4], i.e. building a single instance of a variable font with a specific set of attributes. The CreateInstancedStream method is not a member of a public COM interface, but we have found that it is called by d2d1!dxc::TextConvertor::InstanceFontResources, which led us to find out that it can be reached through the Direct2D printing interface. It is unclear if there are other ways to trigger the font instancing functionality. One example of a client application which uses Direct2D printing is Microsoft Edge. If a user opens a specially crafted website with an embedded OpenType variable font and decides to print it (to PDF, XPS, or another physical or virtual printer), the AFDKO code will execute with the attacker's font file as input. Below is a description of one such security vulnerability in Adobe's library exploitable through the Edge web browser. -----=====[ Description ]=====----- The readStrings() function in afdko/c/public/lib/source/cffread/cffread.c is designed to read the font name string and the string INDEX strings from the input font. The relevant part of the function is shown below: --- cut --- 1727/* Get FontName data and compute its size */ 1728INDEXGet(h, &h->index.name, 0, &FontName); 1729lenFontName = FontName.end - FontName.begin; 1730 1731/* Compute string data size */ 1732lenStrings = (h->index.string.count == 0) ? 0 : (h->region.StringINDEX.end - h->index.string.data + 1 + /* String data bytes */ 1733 h->index.string.count);/* Null termination */ 1734 1735/* Allocate buffers */ 1736dnaSET_CNT(h->string.offsets, h->index.string.count + 1); 1737dnaSET_CNT(h->string.ptrs, h->index.string.count); 1738dnaSET_CNT(h->string.buf, lenFontName + 1 + lenStrings); 1739 1740p = h->string.buf.array; 1741*p = '\0'; 1742if (h->header.major == 1) { 1743/* Copy FontName into buffer */ 1744srcSeek(h, FontName.begin); 1745srcRead(h, lenFontName, p); 1746p += lenFontName; 1747*p++ = '\0'; 1748} --- cut --- The key line is 1738, where an integer overflow may occur. The "lenFontName" variable stores the length of the font name, which can be no greater than 65535. The "lenStrings" variable is initialized in lines 1732/1733 based on the length of the strings INDEX; primarily h->region.StringINDEX.end. The overall h->region.StringINDEX structure is filled out by the generic readINDEX() function, as called by cfrBegFont(): --- cut --- 2712if (h->header.major == 1) { 2713h->region.StringINDEX.begin = h->region.TopDICTINDEX.end; 2714if (h->region.StringINDEX.begin > 0) { 2715readINDEX(h, &h->region.StringINDEX, &h->index.string); 2716/* Read strings */ 2717readStrings(h); 2718} --- cut --- More specifically, h->region.StringINDEX.end is written to in the last line of readINDEX(): --- cut --- 1582/* Read and validate offset size */ 1583index->offSize = read1(h); 1584if (index->offSize < 1 || index->offSize > 4) 1585fatal(h, cfrErrINDEXHeader); 1586 1587index->offset = region->begin + cntSize + 1; /* Get offset array base */ 1588 1589/* Read and validate first offset */ 1590if (readN(h, index->offSize) != 1) 1591fatal(h, cfrErrINDEXOffset); 1592 1593/* Set data reference */ 1594index->data = index->offset + (index->count + 1) * index->offSize - 1; 1595 1596/* Read last offset and compute INDEX length */ 1597srcSeek(h, index->offset + index->count * index->offSize); 1598region->end = index->data + readN(h, index->offSize); 1599} --- cut --- On platforms where "long" is a 32-bit type (Windows x86/x64 and Linux x86), this gives us complete control over the aforementioned field, including setting it to a negative value. This enables us to set the "lenStrings" variable to an arbitrary number, and thus makes it possible to choose it such that the result of the "lenFontName + 1 + lenStrings" expression is smaller than the sum of the font name's length and the length of all other strings. As a result, the heap-based h->string.buf.array object may be overflown, corrupting adjacent allocations in the following lines: --- cut --- 1740p = h->string.buf.array; 1741*p = '\0'; 1742if (h->header.major == 1) { 1743/* Copy FontName into buffer */ 1744srcSeek(h, FontName.begin); 1745srcRead(h, lenFontName, p); 1746p += lenFontName; 1747*p++ = '\0'; 1748} 1749 [...] 1767 1768/* Read string data */ 1769for (i = 0; i < (unsigned long)h->string.ptrs.cnt; i++) { 1770long length = 1771h->string.offsets.array[i + 1] - h->string.offsets.array[i]; 1772srcRead(h, length, p); 1773h->string.ptrs.array[i] = p; 1774p += length; 1775*p++ = '\0'; 1776} --- cut --- Part of the problem contributing to the vulnerability is the unsafe addition in cffread.c:1738, but part of it is also the fact that h->region.StringINDEX.end may be fully controlled through readINDEX() and the function doesn't perform any sanity checking to make sure that the offset is within bounds of the CFF stream. We would therefore recommend adding more checks to readINDEX(), e.g. to also verify that all offsets specified in the INDEX are declared in ascending order and are also within bounds. The same checks should also be added to the analogous readSubrINDEX() function, which is even more permissive, as it allows an arbitrary value of offSize (instead of being limited to the 1-4 range). While we are at it, we also believe that the readN() routine should not ignore the N argument outside of <1 .. 4>, and instead throw a fatal error or at least attempt to read the specified N bytes from the input stream. Its current declaration is shown below: --- cut --- 505/* Read 1-, 2-, 3-, or 4-byte number. */ 506static uint32_t readN(cfrCtx h, int N) { 507uint32_t value = 0; 508switch (N) { 509case 4: 510value = read1(h); 511case 3: 512value = value << 8 | read1(h); 513case 2: 514value = value << 8 | read1(h); 515case 1: 516value = value << 8 | read1(h); 517} 518return value; 519} --- cut --- -----=====[ Proof of Concept ]=====----- The proof of concept file contains a specially crafted String INDEX with the last offset set to -16397 (0xffffbff3) and the font name set to a "AAAA...AAAA" string consisting of 16384 bytes. This causes lenFontName to be equal to 16384 and lenStrings to be equal to -16384, so the whole "lenFontName + 1 + lenStrings" expression evaluates to 1. Despite this, because of the configuration of the h->string.buf dynamic array, the minimum allocation size is in fact 200. Then, a buffer overflow occurs while trying to load the 16384-byte string to the 200-byte allocation in the following line: --- cut --- 1745srcRead(h, lenFontName, p); --- cut --- The font is also specially crafted to parse correctly with DirectWrite but trigger the bug in AFDKO. The original CFF2 table was left untouched, and an extra CFF table from another font was added to the file and corrupted in the way described above. This way, DirectWrite successfully loads the legitimate variable font, and AFDKO processes the modified version as the CFF table takes precedence over CFF2 due to the logic implemented in srcOpen() in afdko/c/public/lib/source/cffread/cffread.c. -----=====[ Crash logs ]=====----- A 32-bit build of "tx" compiled with AddressSanitizer, started with ./tx -cff poc.otf prints out the following report: --- cut --- ================================================================= ==116914==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf3603f88 at pc 0x0810d007 bp 0xffc4bba8 sp 0xffc4b780 WRITE of size 8184 at 0xf3603f88 thread T0 #0 0x810d006 in __asan_memcpy (tx+0x810d006) #1 0x819b191 in srcRead afdko/c/public/lib/source/cffread/cffread.c:481:9 #2 0x817df46 in readStrings afdko/c/public/lib/source/cffread/cffread.c:1745:9 #3 0x8178b5a in cfrBegFont afdko/c/public/lib/source/cffread/cffread.c:2717:13 #4 0x8155d25 in cfrReadFont afdko/c/tx/source/tx.c:137:9 #5 0x81556df in doFile afdko/c/tx/source/tx.c:429:17 #6 0x8152fc9 in doSingleFileSet afdko/c/tx/source/tx.c:488:5 #7 0x81469a6 in parseArgs afdko/c/tx/source/tx.c:558:17 #8 0x814263f in main afdko/c/tx/source/tx.c:1631:9 #9 0xf7b41275 in __libc_start_main #10 0x806a590 in _start 0xf3603f88 is located 0 bytes to the right of 200-byte region [0xf3603ec0,0xf3603f88) allocated by thread T0 here: #0 0x810ddc5 in __interceptor_malloc (tx+0x810ddc5) #1 0x833ccaf in mem_manage afdko/c/public/lib/source/tx_shared/tx_shared.c:73:20 #2 0x8199bfa in dna_manage afdko/c/public/lib/source/cffread/cffread.c:271:17 #3 0x84689ec in dnaGrow afdko/c/public/lib/source/dynarr/dynarr.c:86:23 #4 0x846919d in dnaSetCnt afdko/c/public/lib/source/dynarr/dynarr.c:119:13 #5 0x817dd0d in readStrings afdko/c/public/lib/source/cffread/cffread.c:1738:5 #6 0x8178b5a in cfrBegFont afdko/c/public/lib/source/cffread/cffread.c:2717:13 #7 0x8155d25 in cfrReadFont afdko/c/tx/source/tx.c:137:9 #8 0x81556df in doFile afdko/c/tx/source/tx.c:429:17 #9 0x8152fc9 in doSingleFileSet afdko/c/tx/source/tx.c:488:5 #10 0x81469a6 in parseArgs afdko/c/tx/source/tx.c:558:17 #11 0x814263f in main afdko/c/tx/source/tx.c:1631:9 #12 0xf7b41275 in __libc_start_main SUMMARY: AddressSanitizer: heap-buffer-overflow (tx+0x810d006) in __asan_memcpy Shadow bytes around the buggy address: 0x3e6c07a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c07b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c07c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c07d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x3e6c07e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x3e6c07f0: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c0800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c0810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c0820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c0830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x3e6c0840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone:f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return:f5 Stack use after scope: f8 Global redzone:f9 Global init order: f6 Poisoned by user:f7 Container overflow:fc Array cookie:ac Intra object redzone:bb ASan internal: fe Left alloca redzone: ca Right alloca redzone:cb Shadow gap:cc ==116914==ABORTING --- cut --- A non-instrumented version of "tx" crashes with a SIGSEGV while trying to copy the font name into invalid memory: --- cut --- Program received signal SIGSEGV, Segmentation fault. 0xf7eb50c0 in ?? () from /lib/i386-linux-gnu/libc.so.6 (gdb) x/10i $eip => 0xf7eb50c0:movdqu %xmm1,-0x10(%edx,%ecx,1) 0xf7eb50c6:jbe0xf7eb537e 0xf7eb50cc:movdqu 0x10(%eax),%xmm0 0xf7eb50d1:movdqu -0x20(%eax,%ecx,1),%xmm1 0xf7eb50d7:cmp$0x40,%ecx 0xf7eb50da:movdqu %xmm0,0x10(%edx) 0xf7eb50df:movdqu %xmm1,-0x20(%edx,%ecx,1) 0xf7eb50e5:jbe0xf7eb537e 0xf7eb50eb:movdqu 0x20(%eax),%xmm0 0xf7eb50f0:movdqu 0x30(%eax),%xmm1 (gdb) p/x $xmm1 $1 = {v4_float = {0xc, 0xc, 0xc, 0xc}, v2_double = {0x228282, 0x228282}, v16_int8 = {0x41 <repeats 16 times>}, v8_int16 = {0x4141, 0x4141, 0x4141, 0x4141, 0x4141, 0x4141, 0x4141, 0x4141}, v4_int32 = {0x41414141, 0x41414141, 0x41414141, 0x41414141}, v2_int64 = {0x4141414141414141, 0x4141414141414141}, uint128 = 0x41414141414141414141414141414141} (gdb) info reg $edx edx0x813ea78135522936 (gdb) info reg $ecx ecx0x1ff8 8184 (gdb) x/10gx $edx+$ecx 0x8140a70:Cannot access memory at address 0x8140a70 (gdb) bt #00xf7eb50c0 in ?? () from /lib/i386-linux-gnu/libc.so.6 #10x0805bb9c in srcRead (h=0x8131200, count=16384, ptr=0x813ea78 'A' <repeats 16 times>) at ../../../../../source/cffread/cffread.c:481 #20x080557e3 in readStrings (h=0x8131200) at ../../../../../source/cffread/cffread.c:1745 #30x080548ae in cfrBegFont (h=0x8131200, flags=4, origin=0, ttcIndex=0, top=0x8118024, UDV=0x0) at ../../../../../source/cffread/cffread.c:2717 #40x0804d491 in cfrReadFont (h=0x8118008, origin=0, ttcIndex=0) at ../../../../source/tx.c:137 #50x0804d309 in doFile (h=0x8118008, srcname=0xffffcf11 "poc.otf") at ../../../../source/tx.c:429 #60x0804c9b6 in doSingleFileSet (h=0x8118008, srcname=0xffffcf11 "poc.otf") at ../../../../source/tx.c:488 #70x0804a82a in parseArgs (h=0x8118008, argc=3, argv=0xffffcd58) at ../../../../source/tx.c:558 #80x08049665 in main (argc=3, argv=0xffffcd58) at ../../../../source/tx.c:1631 --- cut --- In case of the Microsoft Edge renderer, it doesn't immediately crash during the buffer overflow, because there is enough mapped heap memory after the overflow allocation to consume the 16kB string. As a result of the memory corruption, however, an exception is generated a little later in the code while trying to access an invalid pointer overwritten with 0x4141...41: --- cut --- First chance exceptions are reported before any exception handling. This exception may be expected and handled. DWrite!fillSet+0x37: 00007ffb<code>29e701a3 39bc2e58020000cmp dword ptr [rsi+rbp+258h],edi ds:41414141</code>41414399=???????? 0:038> u @$scopeip-4 DWrite!fillSet+0x33: 00007ffb<code>29e7019f 488b6b10mov rbp,qword ptr [rbx+10h] 00007ffb</code>29e701a3 39bc2e58020000cmp dword ptr [rsi+rbp+258h],edi 00007ffb<code>29e701aa 7e21jle DWrite!fillSet+0x61 (00007ffb</code>29e701cd) 00007ffb<code>29e701ac 4c8b8c2e50020000 mov r9,qword ptr [rsi+rbp+250h] 00007ffb</code>29e701b4 4c8d4508lea r8,[rbp+8] 00007ffb<code>29e701b8 488d95f8010000lea rdx,[rbp+1F8h] 00007ffb</code>29e701bf 4c03c6add r8,rsi 00007ffb<code>29e701c2 4803d6add rdx,rsi 0:038> db rbx 00000131</code>256e9ca041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 00000131<code>256e9cb041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 00000131</code>256e9cc041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 00000131<code>256e9cd041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 00000131</code>256e9ce041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 00000131<code>256e9cf041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 00000131</code>256e9d0041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 00000131<code>256e9d1041 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA 0:038> k # Child-SPRetAddr Call Site 00 00000008</code>c4d5b550 00007ffb<code>29e7219d DWrite!fillSet+0x37 01 00000008</code>c4d5b5c0 00007ffb<code>29e62314 DWrite!cfwEndSet+0x51 02 00000008</code>c4d5b600 00007ffb<code>29df157a DWrite!AdobeCFF2Snapshot+0x23c 03 00000008</code>c4d5bb00 00007ffb<code>29df0729 DWrite!FontInstancer::InstanceCffTable+0x212 04 00000008</code>c4d5bce0 00007ffb<code>29df039a DWrite!FontInstancer::CreateInstanceInternal+0x249 05 00000008</code>c4d5bf00 00007ffb<code>29dd5a4e DWrite!FontInstancer::CreateInstance+0x192 06 00000008</code>c4d5c260 00007ffb<code>34eb61ab DWrite!DWriteFontFace::CreateInstancedStream+0x9e 07 00000008</code>c4d5c2f0 00007ffb<code>34ea9148 d2d1!dxc::TextConvertor::InstanceFontResources+0x19f 08 00000008</code>c4d5c410 00007ffb<code>0f8b50f4 d2d1!dxc::CXpsPrintControl::Close+0xc8 09 00000008</code>c4d5c460 00007ffb<code>0f88fcb0 edgehtml!CDXPrintControl::Close+0x44 0a 00000008</code>c4d5c4b0 00007ffb<code>0f8947ad edgehtml!CTemplatePrinter::EndPrintD2D+0x5c 0b 00000008</code>c4d5c4e0 00007ffb<code>0f76b515 edgehtml!CPrintManagerTemplatePrinter::endPrint+0x2d 0c 00000008</code>c4d5c510 00007ffb<code>0f3c9175 edgehtml!CFastDOM::CMSPrintManagerTemplatePrinter::Trampoline_endPrint+0x45 0d 00000008</code>c4d5c550 00007ffa`f02e68f1 edgehtml!CFastDOM::CMSPrintManagerTemplatePrinter::Profiler_endPrint+0x25 [...] --- cut --- -----=====[ References ]=====----- [1] https://blog.typekit.com/2014/09/19/new-from-adobe-type-open-sourced-font-development-tools/ [2] https://github.com/adobe-type-tools/afdko [3] https://docs.microsoft.com/en-us/windows/desktop/directwrite/direct-write-portal [4] https://medium.com/variable-fonts/https-medium-com-tiro-introducing-opentype-variable-fonts-12ba6cd2369 Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47098.zip |
体验盒子
